Online Ads Delivered Spyware, Plus 3 Stories
An online ad is supposed to sell you something. It is not supposed to identify your phone, decide that you are an interesting target, and quietly hand you to a spyware operator. Yet researchers say that is exactly what happened to dozens of Al Jazeera employees.
Online ads became a zero-click spyware pipeline
Citizen Lab and ad-security company Confiant traced a surveillance system that turned ordinary targeted advertising into a delivery path for mercenary spyware. The operation, which the researchers call AdFection, used an ad-tech company named Discover-Tech and spyware linked to the Israeli vendor Candiru.
The mechanism matters. When a site or app loads an ad, a real-time bidding system asks multiple companies to compete for that space. The request can include the device type, operating system, approximate location, advertising identifier and other details. A winning ad can also include code. Citizen Lab says Discover-Tech used those auctions to recognize selected devices and, in some cases, deliver a zero-click exploit. The person did not need to tap the ad.
Researchers confirmed infections on 45 Al Jazeera devices during 2024 and 2025. The advertising infrastructure had vastly broader reach, but that does not mean every person who encountered one of its ads was infected. Confiant observed many ads collecting identifiers and a much smaller set associated with the spyware campaign. That distinction is important. Broad access made precise targeting possible; it is not evidence of millions of compromises.
Google removed Discover-Tech from its advertising platforms, IAB Europe suspended the company, and Comcast’s ad-tech unit removed it from its exchange, according to Reuters. That helps, but it does not fix the underlying design. Advertising auctions still broadcast detailed device data to a chain of companies most readers have never heard of.
I would treat ad and tracker blocking as a security control now, especially on work devices and networks. It cannot patch an operating-system flaw or stop every spyware route. It can remove one delivery path and reduce the identifiers available for targeting. Businesses can block ads and trackers at the network gateway, use browsers with strong anti-tracking, and disable or reset mobile advertising IDs through device management. People in journalism, government, activism or other high-risk work should get specialist help if they suspect targeting. The fake Claude installer campaign we covered this week still required somebody to follow a malicious prompt. This operation did not. That is what makes zero-click ad spyware a different security problem. The old advice to avoid clicking strange ads remains useful. It just is not sufficient.
The rules around technology matter too
Platforms, privacy, speech, competition, surveillance, copyright, and regulation increasingly determine what technology companies can build and what the rest of us have to live with. Browse more Raymond Tec News for practical coverage of technology policy and digital rights.
Magento stores need a specific BlockStrap fix
Adobe has released an emergency fix for a critical flaw in Adobe Commerce and Magento Open Source. The vulnerability, CVE-2026-103849, has a severity score of 10 out of 10. An attacker does not need an account, and successful exploitation can lead to remote code execution on the store’s server.
The flaw has been nicknamed BlockStrap. Sansec, which reproduced multiple attack routes, explains that Magento can process an attacker-controlled email template, sign it as trusted content, and then process it again inside a parent template. That second pass can turn a smuggled {{block}} directive into executable behavior. Think of it as a security check approving an envelope, then failing to inspect what unfolds from inside it.
Adobe’s October 13 advisory lists Adobe Commerce versions through 2.4.9, B2B versions through 1.5.3, and Magento Open Source releases through the September 2026 line as affected. Adobe says it knows of no exploitation in the wild. Sansec reported the same as of October 15, but the company also said it reproduced four attack paths within 24 hours. The absence of observed attacks is reassuring, not a reason to leave an internet-facing store exposed.
Store owners should ask their developer or host two precise questions: Was the October security release or isolated BlockStrap patch applied to the running site, and was the separate September VULN-39341 hotfix preserved? A normal Composer install may still be vulnerable. Sansec says older Magento Open Source sites on 2.4.6 or earlier need to move to 2.4.7-p10 or later because the public patch does not cover those old branches. Back up first, test checkout and email flows, then verify the deployed code contains the fix. “The update job finished” is not the same as “this vulnerability is closed.”
Technical discovery & auditing
The public page doesn’t tell you much about the machinery behind it. Raymond Tec audits inherited and long-running projects to uncover the plugins, integrations, data, dependencies, and old decisions that determine what the next change will really involve.
Eight states put ChatGPT safety claims in court
Attorneys general in Arizona, Arkansas, Idaho, Iowa, Kansas, Montana, Nebraska and West Virginia filed separate lawsuits against OpenAI on October 14. The states allege that ChatGPT can reinforce delusions, encourage dangerous behavior, and mislead consumers about protections for children and vulnerable users. They are seeking product changes, consumer-protection remedies and financial penalties.
These are allegations, not findings that OpenAI is liable. OpenAI told the Associated Press that it has added protections, introduced ChatGPT for Teens, continues to improve its systems, and is willing to work with the states. The cases will test not only what the chatbot said in particular conversations, but also what the company knew, how it described safeguards, and whether those safeguards worked as represented.
For families and organizations, the practical point is more immediate than the lawsuits’ eventual outcome. A chatbot can sound attentive and confident without understanding a person or bearing responsibility for the advice. It is not a therapist, crisis line, doctor or trusted adult. Review teen account settings, keep human support in the loop, and treat alarming or medical guidance as something to verify with a qualified person. That is not an argument to ban every useful AI tool. It is an argument to stop confusing fluency with judgment.
Turning on AI is the easy part
Deciding what an AI tool should be allowed to see, who should use it, what work it should perform, and what happens when it gets something wrong is the more interesting problem. Raymond Tec helps businesses connect and automate the tools they actually use without treating every new feature like a button that obviously needs to be switched on.
Temu accepts Texas data and product-safety limits
Temu has settled a Texas investigation into data privacy and unsafe products. Under the agreement made public October 16, the marketplace must keep Texas shoppers’ data on US servers and limit access or transfers to China to what is necessary to complete transactions. It also agreed to annual independent product-safety testing, removal of dangerous products, termination of sellers responsible for them, and notices and refunds for affected Texas customers.
Temu will pay $3 million to the state, could face annual penalties for violations, and admitted no wrongdoing. The company also denied Texas’s allegations about its app code. This is a Texas settlement, not a nationwide rule, so shoppers elsewhere should not assume the same protections automatically apply. Still, it gives other regulators a concrete template: privacy promises need to cover where data sits and who can reach it, while marketplace safety needs testing, seller consequences and refunds rather than another carefully worded policy page. Texas customers do not need to take a special step today, but they should act on any product recall or refund notice they receive.
Still in a reading mood? The Raymond Tec News archive covers security, AI, small-business technology, policy, and the places technology collides with ordinary life — without requiring a computer-science degree to get through it.
Sources / Further Reading
- Citizen Lab: How Discover-Tech turned targeted ads into a pipeline for spyware
- Confiant: Weaponized ad tech and zero-click spyware
- Reuters: Israeli firm used online ads in spyware operation
- Adobe security bulletin APSB26-153
- Sansec: BlockStrap Magento remote code execution
- BleepingComputer: Critical BlockStrap flaw
- Reuters: Eight US states sue OpenAI
- Associated Press: State lawsuits challenge ChatGPT safeguards
- Reuters: Temu agrees to Texas privacy restrictions
Photo by cottonbro studio on Pexels.
